[libunwind] Add missing checks for register number

[mstorsjo]

Summary

Most other cases that touch savedRegisters[reg] have got this check, but these three seemed to lack it.

[rnk]

lgtm

[compnerd]

I'd say out of range rather than too big.

[mstorsjo]

In D39206#904723, @compnerd wrote:

I'd say out of range rather than too big.

Ok, pushing with the message changed to out of range, and actually printing the value.

libunwind/trunk/src/DwarfParser.hpp

case DW_CFA_def_cfa_offset_sf:
       results->cfaRegisterOffset = (int32_t)
         (addressSpace.getSLEB128(p, instructionsEnd) * cieInfo.dataAlignFactor);
       results->codeOffsetAtStackDecrement = (uint32_t)codeOffset;
       _LIBUNWIND_TRACE_DWARF("DW_CFA_def_cfa_offset_sf(%d)\n",
                              results->cfaRegisterOffset);
       break;
     case DW_CFA_val_offset:
       reg = addressSpace.getULEB128(p, instructionsEnd);
+      if (reg > kMaxRegisterNumber) {
+        fprintf(stderr,
+                "malformed DW_CFA_val_offset DWARF unwind, reg (%" PRIu64
+                ") out of range\n",
+                reg);
+        return false;
+      }
       offset = (int64_t)addressSpace.getULEB128(p, instructionsEnd)
                                                     * cieInfo.dataAlignFactor;
       results->savedRegisters[reg].location = kRegisterOffsetFromCFA;
       results->savedRegisters[reg].value = offset;
       _LIBUNWIND_TRACE_DWARF("DW_CFA_val_offset(reg=%" PRIu64 ", "
                              "offset=%" PRId64 "\n",
                              reg, offset);
       break;
case DW_CFA_GNU_negative_offset_extended:
       _LIBUNWIND_TRACE_DWARF(
           "DW_CFA_GNU_negative_offset_extended(%" PRId64 ")\n", offset);
       break;
     default:
       operand = opcode & 0x3F;
       switch (opcode & 0xC0) {
       case DW_CFA_offset:
         reg = operand;
+        if (reg > kMaxRegisterNumber) {
+          fprintf(stderr, "malformed DW_CFA_offset DWARF unwind, reg (%" PRIu64
+                          ") out of range\n",
+                  reg);
+          return false;
+        }
         offset = (int64_t)addressSpace.getULEB128(p, instructionsEnd)
                                                     * cieInfo.dataAlignFactor;
         results->savedRegisters[reg].location = kRegisterInCFA;
         results->savedRegisters[reg].value = offset;
         _LIBUNWIND_TRACE_DWARF("DW_CFA_offset(reg=%d, offset=%" PRId64 ")\n",
                                operand, offset);
         break;
       case DW_CFA_advance_loc:
         codeOffset += operand * cieInfo.codeAlignFactor;
         _LIBUNWIND_TRACE_DWARF("DW_CFA_advance_loc: new offset=%" PRIu64 "\n",
                                static_cast<uint64_t>(codeOffset));
         break;
       case DW_CFA_restore:
         reg = operand;
+        if (reg > kMaxRegisterNumber) {
+          fprintf(stderr, "malformed DW_CFA_restore DWARF unwind, reg (%" PRIu64
+                          ") out of range\n",
+                  reg);
+          return false;
+        }
         results->savedRegisters[reg] = initialState.savedRegisters[reg];
         _LIBUNWIND_TRACE_DWARF("DW_CFA_restore(reg=%" PRIu64 ")\n",
                                static_cast<uint64_t>(operand));
         break;
       default:
         _LIBUNWIND_TRACE_DWARF("unknown CFA opcode 0x%02X\n", opcode);
         return false;
       }